CVE-2025-63498

Stored XSS in cookie Alinto/SOGo 연구자: Daniil Khomichenok, Alexander Klimenko 영향을 받는 버전 var cookieUsername = "[email protected]'123'"; var language = 'English'; var loginHint = '' XSS 인젝션을 매개변수 값으로 허용하는 로그인 기억 설정 쿠키 코드: if rememberLogin response addCookie: self cookieWithUsername: params...

CVE-2024-43044-jenkins

소개 이것은 CVE-2024-43044에 대한 익스플로잇입니다. 이 취약점은 에이전트가 컨트롤러에서 파일을 가져올 수 있도록 하는 임의 파일 읽기입니다. 이 익스플로잇은 취약점을 이용해 파일을 읽어 관리자 계정의 remember-me 쿠키를 위조하고 Jenkins 스크립팅 엔진에 접근 권한을 얻습니다. 전체 분석 내용은 https://blog.convioappsec.com/en/analysis-of-cve-2024-43044/ 에서 확인하세요. 익스플로잇 빌드 mvn package 익스플로잇 실행 Exploit Usages:...

Kimai-CVE-2026-49865-POC

Kimai CVE-2026-52824 — Default APPSECRET Authentication Bypass Note: The repository URL contains an outdated CVE ID CVE-2026-49865. The correct and current CVE tracked in this repository is CVE-2026-52824 GHSA-jr9p-4h4j-6c58. Proof-of-concept exploit toolkit for the hardcoded default APPSECRET...

CVE-2026-84652

A flaw was found in Jenkins. When a user authenticates using the "remember me" cookie, Jenkins fails to rotate the session identifier. This oversight allows a remote attacker, who can serve content on the same site as Jenkins, to set a known session cookie in a victim's browser. Consequently, onc...

CVE-2026-76949

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

EUVD-2026-82578

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

EEF-CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Summary Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949

CVE-2026-76949 is an Authentication Bypass by Spoofing flaw in the Elixir library ash_authentication (by team-alembic). The root cause is a session-key mismatch: sign_in_using_remember_me/3 checks for "_token", but store_in_session/2 only writes that key when require_token_presence_for_authentica...

CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

CVE-2026-76949: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account...

BIT-JENKINS-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

PT-2026-88169

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins versions 2.579 and earlier (including LTS 2.568.2 and earlier ), a vulnerability exists where the application fails to rotate the session when a user authenticates using the "remember me" cookie. An attacker capable of serving content on the same site as Jenkins can set a known session...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...